From e07c059a4bfdc3e5347f6cd5a183a16c88b786b4 Mon Sep 17 00:00:00 2001 From: Hermes Agent Date: Tue, 3 Nov 2026 03:34:06 +0000 Subject: [PATCH] Anchor checksum grep to exclude upstream .sbom.json entries Upstream checksums.txt has listed .sbom.json sidecars alongside the tarballs since v2.1.0; the unanchored grep matched both lines and sha256sum -c failed on the never-downloaded sbom file, breaking every scheduled build (runs 237, 243). --- Dockerfile | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 2494889..0a6adb5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -37,7 +37,9 @@ WORKDIR /tmp # Fetch the release checksums file and the linux/${TARGETARCH} tarball, then # verify the tarball's sha256 against the checksums file. Fails the build on -# any mismatch (checksums.txt entries: " mcp-grafana_Linux_.tar.gz"). +# any mismatch. The grep is line-anchored: upstream checksums.txt also lists +# .sbom.json sidecar entries for the same tarball names, which must stay out +# of the sha256sum input (only the downloaded tarball is verified). RUN set -eux; \ SHORT="${MCP_GRAFANA_VERSION#v}"; \ case "$TARGETARCH" in \ @@ -47,7 +49,7 @@ RUN set -eux; \ esac; \ curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${SHORT}_checksums.txt" -o checksums.txt; \ curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${ASSET}.tar.gz" -o "mcp-grafana_${ASSET}.tar.gz"; \ - grep "mcp-grafana_${ASSET}.tar.gz" checksums.txt | sha256sum -c -; \ + grep "mcp-grafana_${ASSET}\.tar\.gz$" checksums.txt | sha256sum -c -; \ tar -xzf "mcp-grafana_${ASSET}.tar.gz" mcp-grafana; \ chmod +x mcp-grafana